AMLConsensus · course
Programme · Lesson 5.1
Section 5 · Lesson 5.1

Blockchain explorers: a complete walkthrough

An explorer is the basic tool of any AML analyst — and the only one that is completely free and shows raw primary data with no one else's interpretation layered on top. Paid platforms hand you a ready-made score, but it is in the explorer that you see the transactions, the age, the volumes and the counterparties with your own eyes. In this lesson we map out the key explorers by network, what exactly to look at in them, and how to read the tabs so you can build a first portrait of a wallet in five minutes.

A map of explorers by network

First rule: an explorer is tied to a network. An Ethereum address will not open in a Bitcoin explorer. Keep a set ready for the main blockchains.

Why you need several. Many grey flows deliberately move into networks that get less compliance attention — Tron, BSC, Solana. An analyst who knows only Etherscan is blind to most of the real USDT turnover. A set of explorers covering all the common networks is mandatory hygiene.

What to look at: five primary signals

Once an address is open, an analyst can take a baseline profile within a few minutes. Go through it in order.

  1. Address age. The date of the first transaction. A freshly created wallet (hours/days old) handling a large payment is a classic sign of a "pass-through" (a one-off intermediate address).An old, active address with a long history is, in itself, a weak plus to trust.
  2. Volumes and turnover. Total inflow/outflow, current balance, number of transactions. Sharp spikes, or a large sum "run through" and out in a single day, are an obfuscation flag.A quiet wallet with occasional everyday amounts behaves differently from a transit node.
  3. Counterparties. Who the address interacts with. Direct transfers to/from exchanges, mixers, known services. Counterparties are where most of the signal comes from.A single mixer counterparty matters more than a hundred everyday transfers.
  4. Labels/tags. Public tags that the explorer or the community has assigned to an address.Etherscan flags exchanges, well-known contracts, phishing addresses (Fake_Phishing) and scams. See lesson 5.2.
  5. Behaviour pattern. Inflow split across dozens of addresses and paid out as one sum (or the reverse) is structuring. Regular equal amounts point to automation or a service.The shape of the graph tells you the wallet's purpose.

How to read Etherscan's tabs

Let's work through the benchmark interface — reading it teaches you how to read every EVM scan too. An address has a set of tabs, and each answers its own question.

A common beginner's mistake. Looking only at the Transactions tab and concluding "the wallet is barely active." In reality the entire turnover may run through Token Transfers (USDT) and Internal Txns (via contracts). Always check all three: Transactions, Internal, Token Transfers. Otherwise the picture will look falsely calm.

The specifics of non-EVM networks

Bitcoin, Tron and Solana are built differently, and you have to read them with an allowance for the model.

  1. Bitcoin (mempool.space, Blockchair). A UTXO model, not an "address balance." A single transaction has many inputs and outputs; the notion of an "address balance" is conditional, and people use a new address for each operation.Flows are tracked by UTXO and by clustering the addresses that belong to one owner.
  2. Tron (Tronscan). USDT-TRC20 is the main object. Look at the token-transfers tab, not TRX. Pay attention to energy/bandwidth (the resource model).A great deal of grey P2P turnover is right here.
  3. Solana (Solscan). A model of accounts and separate token accounts. One wallet has child token accounts for each SPL token.History is read via transaction signatures; the interface is less "human" than Etherscan's.

Keep in mind, too, that the speed and completeness of indexing differ across explorers: a fresh transaction may appear in one scan seconds earlier than in another, and a brand-new token contract will for a while show with no name and empty labels. If the data looks suspiciously "empty," re-check the address in an alternative explorer for the same network — a discrepancy often means not cleanliness but a delay or incomplete indexing on that particular service.

A mini workflow: a first review in 5 minutes

1. Identify the network
address format → scan
→
2. Age + turnover
first txn, volumes
→
3. Counterparties + labels
exchanges, mixers, tags
→
4. Pattern
splitting/transit?

That is enough to decide whether a wallet looks clean at first glance, or whether it needs a deeper check against sanctions lists and (if necessary) paid platforms.

Lesson takeaway. The explorer is your eyes on the blockchain and a foundation that costs nothing. It shows raw facts — age, volumes, counterparties, labels — from which a first portrait is assembled. But the explorer will not know that a counterparty address is sanctioned unless that is in its public labels. So the next step is to learn to check addresses against sanctions lists and public label databases, and to check stablecoin freezes directly in the contract. That is lesson 5.2.
← Programme Programme →

This material is for educational purposes.